Consent Tracking
Track consent per message type for GDPR/CASL
Consent Tracking
Consent tracking is a critical component of GDPR and CASL compliance. Mailnaptic provides granular consent management that records not just whether a contact has consented, but exactly what they consented to, when, and how. This detailed tracking protects your organization and demonstrates accountability to regulators.
Consent Per Message Type
Under strict GDPR and CASL interpretations, consent for marketing emails does not automatically cover transactional communications, and vice versa. Mailnaptic supports consent per message type, which requires separate, explicit consent for each category of communication:
- Marketing: Promotional emails, newsletters, offers, and announcements.
- Transactional: Order confirmations, shipping updates, password resets, and account notifications.
- Operational: Service changes, policy updates, and security alerts.
To enable this strict mode, navigate to Organization → Compliance Settings and toggle Require consent per message type. When enabled, campaigns must be tagged with their message type, and Mailnaptic verifies that each recipient has consented to that specific type before including them in the send.
What Gets Recorded
Every consent event in Mailnaptic captures the following details:
- Contact: The contact who gave or withdrew consent.
- Message type: Which type of communication the consent applies to.
- Action: Whether consent was granted or withdrawn.
- Timestamp: The exact date and time of the consent action.
- Source: How consent was collected — signup form, preference center, API, manual entry, or import.
- IP address: The IP address from which the action was performed (for web-based consent).
- Evidence: Reference to the specific form or mechanism used (e.g., form ID, API endpoint).
Viewing Consent History
On any contact's detail page, navigate to the Consent tab to see their full consent history. This shows a chronological timeline of all consent grants and withdrawals, making it easy to demonstrate to regulators that you have a valid legal basis for processing each contact's data.
Consent Collection Methods
Mailnaptic collects consent through several channels:
- Signup forms: Forms can include checkboxes for specific consent types. Each checkbox maps to a message type.
- Preference center: Contacts can manage their consent preferences directly.
- API: Pass consent data when creating or updating contacts programmatically, including the source and timestamp.
- CSV import: Map consent columns in your import file to the appropriate consent types.
Withdrawing Consent
When a contact withdraws consent (via unsubscribe, preference center, or explicit request), the withdrawal is recorded immediately and Mailnaptic stops sending the affected message types to that contact. Consent withdrawal does not delete the historical consent record — it adds a new entry showing the withdrawal, preserving the full audit trail.